Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-48924MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflowNuGet · messagepack · fixed in 2.5.187, 3.0.214-rc.1
- CVE-2024-43485.NET and Visual Studio Denial of Service VulnerabilityNuGet · system.text.json · fixed in 8.0.5, 6.0.10
- CVE-2024-43484.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityNuGet · system.io.packaging · fixed in 9.0.0-rc.2.24473.5, 8.0.1, 6.0.1
- CVE-2024-43483.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.extensions.caching.memory, system.io.packaging +1 · fixed in 8.0.1, 9.0.0-rc.2.24473.5, 6.0.2 and more
- CVE-2024-38229.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 9.0.0-rc.2.24474.3, 8.0.10
- CVE-2024-45302CRLF Injection in RestSharp's `RestRequest.AddHeader` methodNuGet · restsharp · fixed in 112.0.0
- CVE-2024-44930Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by NuGet · serilog.enrichers.clientinfo · fixed in 2.1.0
- CVE-2024-43377Umbraco CMS Improper Access Control vulnerabilityNuGet · umbraco.cms · fixed in 14.1.2
- CVE-2024-43376Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive InformationNuGet · umbraco.cms.api.management · fixed in 14.1.2
- CVE-2024-38168.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.win-arm, microsoft.aspnetcore.app.runtime.win-arm64 +2 · fixed in 8.0.8
- CVE-2024-38167.NET and Visual Studio Information Disclosure VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 8.0.8
- CVE-2024-39694Duende IdentityServer Open Redirect vulnerabilityNuGet · duende.identityserver, identityserver4 · fixed in 7.0.6, 6.3.10, 6.2.5 and more
- CVE-2024-41799tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned usersNuGet · tgstation.server.api, tgstation.server.host · fixed in 6.8.0
- CVE-2024-41132SixLabors ImageSharp Allows Excessive Memory Allocation in Gif DecoderNuGet · sixlabors.imagesharp · fixed in 2.1.9, 3.1.5
- CVE-2024-41131Out-of-bounds Write in SixLabors ImageSharpNuGet · sixlabors.imagesharp · fixed in 2.1.9, 3.1.5
- CVE-2024-28698Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted scripNuGet · csla · fixed in 5.5.4, 8.0.0
- CVE-2024-40636Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer AwarenessNuGet · steeltoe.discovery.clientautofac, steeltoe.discovery.clientcore +2 · fixed in 3.2.8
- CVE-2024-38095.NET and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +11 · fixed in 8.0.7, 6.0.32, 6.0.1 and more
- CVE-2024-38081.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.io.redist · fixed in 6.0.1
- CVE-2024-30105.NET and Visual Studio Denial of Service VulnerabilityNuGet · system.text.json · fixed in 8.0.4
- CVE-2024-35264.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 8.0.7
- CVE-2024-39677NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilitiesNuGet · nhibernate · fixed in 5.4.9, 5.5.2
- CVE-2024-33862A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers toNuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.5.374.54
- CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elementsNuGet · tinymce · fixed in 5.11.0, 6.8.4, 7.2.0
- CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp optionNuGet · tinymce · fixed in 5.11.0, 6.8.4, 7.2.0
- CVE-2024-35252Azure Storage Movement Client Library Denial of Service VulnerabilityNuGet · microsoft.azure.storage.datamovement · fixed in 2.0.5
- CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityNuGet · azure.identity, microsoft.identity.client · fixed in 1.11.4, 4.60.4, 4.61.3
- CVE-2024-35240Stored Cross-site Scripting on Print Functionality in Umbraco CommerceNuGet · umbraco.commerce · fixed in 12.1.4, 10.0.5
- CVE-2024-35239Stored Cross-site Scripting on Components of Umbraco FormsNuGet · umbraco.forms · fixed in 13.0.1, 12.2.2, 10.5.3 and more
- CVE-2024-35218Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview PaneNuGet · umbracocms.core · fixed in 8.18.13, 10.8.4, 12.3.7 and more